Authorization Bypass in Tutor LMS WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary WordPress posts — including pages, courses, quizzes, and WooCommerce products — via wp_delete_post( $id, true ). The exploit chain requires the attacker to first trigger the profile-photo upload flow to obtain an authored wp_posts attachment row, then create a Tutor topic reparented to that attachment, before invoking the lesson deletion handler against any target post ID.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-88944

Affected Vendors & Products

Vendor	Product	Version / Range
tutor_lms	tutor_lms	to 4.0.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The Tutor LMS plugin for WordPress has an authorization bypass flaw in versions up to 4.0.8. This allows authenticated users with subscriber-level access or higher to delete any WordPress post, including courses, pages, quizzes, and WooCommerce products. The attack involves uploading a profile photo to create an attachment, then reparenting a topic to that attachment before deleting any post via a specific handler.

Impact Analysis

If you use the Tutor LMS plugin, an attacker with minimal access could delete critical content like courses, pages, or products. This could disrupt your website's functionality, cause data loss, and require recovery efforts. The impact depends on the importance of the deleted content.

Mitigation Strategies

Update the Tutor LMS plugin to the latest version beyond 4.0.8 immediately to patch the authorization bypass vulnerability.

Hi! I’m here to help you understand CVE-2026-88944. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70